Detections
Analytics
5.1.1 Ensure access to /etc/ssh/sshd_config is configured
Information
The file /etc/ssh/sshd_config, and files ending in .conf in the /etc/ssh/sshd_config.d directory, contain configuration specifications for sshd.Configuration specifications for sshd need to be protected from unauthorized access by non-privileged users.
Solution
Run the following script to set ownership and permissions on /etc/ssh/sshd_config and files ending in .conf in the /etc/ssh/sshd_config.d directory:#!/usr/bin/env bash
{
chmod u-x,og-rwx /etc/ssh/sshd_config
chown root:root /etc/ssh/sshd_config
while IFS= read -r -d $'\0' l_file; do
if [ -e "$l_file" ]; then
chmod u-x,og-rwx "$l_file"
chown root:root "$l_file"
fi
done < <(find /etc/ssh/sshd_config.d -type f -print0 2>/dev/null)
}
- IF - other locations are listed in an Include statement, *.conf files in these locations access should also be modified.
Impact:
Restricting /etc/ssh/sshd_config and its drop-in .conf files to mode 0600, owner and group root, removes read access for non-root users and processes. Any configuration-management, monitoring, or user workflow that reads the SSH server configuration without elevated privileges will need to run with root privileges.
See Also
Item Details
Audit Name: CIS Oracle Linux 9 v3.0.0 L1 Server
Category: ACCESS CONTROL, MEDIA PROTECTION
References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6
Plugin: Unix
Control ID: 48d70c0b7ddba6e8da55e5759051da0217f2c3d6427b6c0675ad752ea834e576